CISA Warns Of Windows Improper Access Control Vulnerability Exploited In Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in Microsoft Windows, adding it to its Known Exploited Vulnerabilities catalog. The vulnerability, identified as CVE-2025-59230 , originates from improper…
The Cybersecurity and Infrastructure Security Agency (CISA) has identified a critical vulnerability in Microsoft Windows, adding it to its Known Exploited Vulnerabilities catalog. The vulnerability, identified as CVE-2025-59230 , originates from improper access control in the Windows Remote Access Connection Manager service.
This local privilege escalation vulnerability allows an authorized user to gain elevated permissions, potentially compromising networks. Microsoft disclosed the issue in a security update, indicating that it affects multiple Windows versions, including Windows 10, 11, and Server editions. The flaw is classified under CWE-284 for improper access control .
Exploiting this vulnerability enables attackers to manipulate system files, install malware, or navigate to other networked machines. Despite its simplicity, it poses significant risks, potentially serving as an entry point for cybercriminals. CISA's alert, released on October 15, 2025, mandates that federal agencies address this vulnerability by November 5 to avoid compliance issues under Binding Operational Directive 22-01.
The vulnerability, identified as CVE-2025-59230 , originates from improper access control in the Windows Remote Access Connection Manager service.
The vulnerability has a CVSS v3.1 base score of 7.8, reflecting the ease of local exploitation and potential for system takeover. The affected component is the RasMan service, responsible for managing VPN and dial-up connections. Microsoft has issued patches through its October 2025 Patch Tuesday updates, encouraging immediate application.
IT administrators should prioritize applying Microsoft's security updates and consider disabling unnecessary Remote Access services. Implementing least-privilege access controls is advisable. Tools like Microsoft Defender for Endpoint can detect exploitation attempts through behavioral monitoring. For systems where patching is not possible, CISA recommends isolating affected machines or discontinuing the vulnerable product.
In conclusion, this incident underscores the importance of timely patching in Windows environments. Unpatched systems remain vulnerable to exploitation, posing significant risks to enterprises globally.
Based on reporting by Cyber Security News.